The target URLs often include a secondary URL appended to the end of a permalink

An increasing number of attacks employ random character strings to probe for holes

Yet despite the apparent complexity of such attacks, they tend to look remarkably similar. Specifically, notice the trends in the following examples of (nonexistent) target URLs, or “attack strings,” as I like to call them:

Now imagine hundreds or even thousands of requests for each of these different URL variations, each targeting a different preexisting resource. So, for example, using the first attack string from our list, such an attack would generate the following log entries:

Then, associated with each of these attacks is a unique (or semi-unique) IP address and (faked) user agent. Occasionally, such attacks will be executed from a single machine or even small network, in which case the user agent for each entry is generally generically randomized to avoid user-agent-based blacklists. More typically, however, the current state of spammer and cracker attacks employs a virtually “unblockable” array of user agents and IP addresses. In short, recent blacklisting methods relying on either of these variables are becoming increasingly less effective at stopping malicious attacks.

By blocking key portions of the actual strings used in an attack, we are targeting an “unfakable” variable and preventing its use in any capacity. For example, referring to our previously given collection of attack strings, we are able block almost the entire collection with a single line of code:

redirectmatch 403 http\:\/\/

Within the context of current server-exploitation techniques, that one line of code is an immensely powerful weapon for closing the door on malicious attacks. By focusing our blacklisting efforts directly on the attack vector itself, we employ a strategy that transcends the emergent complexity and variation inherent among intrinsic attack parameters. They can fake the user agents, the IP addresses, and just about everything else, but they can’t fake the (potential) targets of their attacks. Attack strings contain patterns that remain far more constant than previously targeted variables. And it gets even better..

Presenting the 2G Blacklist

For several months now, I have been harvesting key portions of malicious attack strings from my access logs and adding them to my new and improved “2G” blacklist. After the addition of each new string, I take as much time as possible to test the effectiveness of the block and ensure that it doesn’t interfere with normal functionality. Although highly effective in its current state, the 2G Blacklist is a work in progress. As time goes on, this blacklisting method will certainly evolve to keep up with the rapidly changing arsenal of spammer and cracker attacks. To stay current with this and many other security measures, I encourage you to subscribe to Perishable Press. As mentioned, this blacklist is designed for Apache servers equipped with the mod_alias module. You will need access to your site’s root htaccess file, into which you simply copy & paste the following code:

A brief rundown of what we are doing here.. First, notice that the entire list is enclosed with an “IfModule” test container; this ensures that your site will not crash if for some reason mod_alias becomes unavailable. The list itself is elegantly simple. Each line targets a specific string of characters that, if matched in the URL, will return a server status 403 — forbidden — HTTP error code. Nice, clean, and easy.

Wrap Up..

Although highly effective at stopping many attacks, this blacklist is merely another useful tool in the ongoing hellish battle against the evil forces of the nefarious online underworld. It is meant to complement existing methods, not replace them. Is there still benefit from blocking certain ranges of IPs? Yes, subscribe to my friend Will Macc over at A Daily Rant to understand why. Is there still benefit from blocking certain user agents? Yes, many spammers, scrapers and crackers have yet to spoof this aspect of their game — there are many well-known and well-hated user agents that should be banned. Is there still benefit from blocking individual IP addresses? As discussed elsewhere at Perishable Press, yes, crackers and attackers have their favorite locations and certain zombie machines are easier to manipulate than others. It is in addition to these tools, then, that the 2G Blacklist serves as a solid defense against malicious attacks.

@Perishable: It was actually a valid comment and not spam lol.. I am a regular visitor of your site and decided to start commenting and not just fly-by and never say a word. Since you asked what tool I used to identify popular posts.. I didn’t use any tool for that — Just went through my bookmarks I had on htaccess rules. – Cheers -

Thanks for the response, Aaron. I hate to be so skeptical, but I get a lot of “targeted” comments. Of course, I am always grateful for sincere comments, and appreciate the fact that you find the content worthy of bookmarking! :)
Kind regards,
Jeff

Thanks, TechJammer, I am glad you find the site useful! Thanks also for referring people to the site — it is greatly appreciated :)

Also, I am glad you discovered the high-contrast toggle link in the corner of the current theme, but be advised that the default design will be changing soon, and the new design also features a dark background. I am trying to increase the usability of the new design by increasing the size and contrast of the text such that an alternate “light” theme will no longer be necessary. But fear not! The new design will provide easy-access to this and all of the previous alternate themes.

Thanks a lot for this post. I was under heavy attack from a bizzard spammer for a couple days before coming through with various plugin. But I do think mastering .htaccess is a key component for a wed admin toolkit. Thanks again.

Books

Links

About the site

Perishable Press is the work of Jeff Starr, professional developer, designer, author, and publisher with over 10 years of experience. Check out some of Jeff's books and projects, follow on Twitter, or learn more »

Fun fact: Perishable Press has been online since 2005, and now features over 700 articles and more than 11,000 comments. More stats »